abuild: fix --xattrs and --{owner,group}-map not passed to tar

Fixes <45a8c0dd79c> abuild: deduplicate reproducible tarball creation

.editorconfig

@@ -20,3 +20,7 @@ indent_style = space
 [Makefile]
 indent_size = 8
 indent_style = tab
+
+[*.yml]
+indent_size = 2
+indent_style = space

.gitlab-ci.yml

@@ -5,7 +5,27 @@ tests:
   image:
     name: alpinelinux/abuild-ci
   stage: verify
-  script: [pwd]
+  script:
+    - make
+    - make check
+  tags:
+    - docker-alpine
+    - x86_64
+
+build-clang:
+  image:
+    name: alpinelinux/abuild-ci
+  stage: verify
+  script: [CC=clang make]
+  tags:
+    - docker-alpine
+    - x86_64
+
+build-scan:
+  image:
+    name: alpinelinux/abuild-ci
+  stage: verify
+  script: [scan-build --status-bugs make]
   tags:
     - docker-alpine
     - x86_64

.mailmap

@@ -0,0 +1 @@
+Kaarle Ritvanen <kunkku@alpinelinux.org> <kaarle.ritvanen@datakunkku.fi>

APKBUILD.5.scd

@@ -168,6 +168,12 @@ file.
 	Specifies packages that the package replaces. This is typically
 	used for packages renamed by upstream.
 
+*replaces_priority*
+	Specifies the numeric value that is used by apk(8) when multiple
+	packages with *replaces* include the same file. It is also used
+	to decide which package should define the permissions of a directory
+	even without *replaces* set.
+
 *subpackages*
 	Specifies subpackages or split packages built with this
 	package. Typically, this will include _$pkgname-dev_ for development
@@ -215,6 +221,11 @@ file.
 		packages containing firmware, and should typically never
 		be needed.
 
+	*bigdocs*
+		Specifies that this packages intentionally has a large -doc subpackage.
+		Thereby suppressing a warning to be emitted if the -doc subpackage
+		exceeds a certain package size threshold (currently 2 MiB).
+
 	*charset.alias*
 		Specifies that the package ships a _/usr/lib/charset.alias_
 		file and that it should be installed on the user's
@@ -273,6 +284,12 @@ file.
 		to use capabilities or process separation instead of set-uid
 		where available.
 
+	*setcap*
+		Specifies that binaries in the package may be installed
+		with extra setcap(8) capabilities. If this option is enabled,
+		it is highly recommended to only make these binaries executable
+		by root and users of a specific group, not by others.
+
 	*textrels*
 		Specifies that the package's binaries are known to contain
 		relocations against text segments. By default, abuild(1)
@@ -446,7 +463,7 @@ preferred /bin/sh, which is typically bash(1).
 # SEE ALSO
 
 SPDX license reference (on the Web at <https://spdx.org/licenses/>),
-abuild(1), newapkbuild(1), apk(8).
+abuild(1), newapkbuild(1), apk(8), buildrepo(1).
 
 
 # HISTORY

Makefile

@@ -1,5 +1,5 @@
 PACKAGE		:= abuild
-VERSION		:= 3.11.3
+VERSION		:= 3.14.1
 
 prefix		?= /usr
 bindir		?= $(prefix)/bin
@@ -11,8 +11,8 @@ SCRIPTS		:= abuild abuild-keygen abuild-sign newapkbuild \
 		   abump apkgrel buildlab apkbuild-cpan apkbuild-pypi checkapk \
 		   apkbuild-gem-resolver
 USR_BIN_FILES	:= $(SCRIPTS) abuild-tar abuild-gzsplit abuild-sudo abuild-fetch abuild-rmtemp
-MAN_1_PAGES	:= newapkbuild.1 abuild.1
-MAN_5_PAGES	:= APKBUILD.5
+MAN_1_PAGES	:= newapkbuild.1 abuild.1 abump.1
+MAN_5_PAGES	:= APKBUILD.5 abuild.conf.5
 SAMPLES		:= sample.APKBUILD sample.initd sample.confd \
 		sample.pre-install sample.post-install
 MAN_PAGES	:= $(MAN_1_PAGES) $(MAN_5_PAGES)
@@ -58,7 +58,7 @@ LDFLAGS-abuild-gzsplit = $(ZLIB_LIBS)
 OBJS-abuild-sudo = abuild-sudo.o
 OBJS-abuild-fetch = abuild-fetch.o
 
-TEST_TIMEOUT = 15
+TEST_TIMEOUT = 30
 
 .SUFFIXES:	.conf.in .sh.in .in
 %.conf: %.conf.in
@@ -127,35 +127,25 @@ Kyuafile: tests/Kyuafile
 	echo "include('tests/Kyuafile')" >> $@
 
 check: $(SCRIPTS) $(USR_BIN_FILES) functions.sh tests/Kyuafile Kyuafile tests/testdata/abuild.key.pub
-	kyua test || (kyua report --verbose && exit 1)
+	kyua --variable parallelism=$(shell nproc) test || (kyua report --verbose && exit 1)
 
-install: $(USR_BIN_FILES) $(SAMPLES) $(MAN_PAGES) default.conf abuild.conf functions.sh
-	install -d $(DESTDIR)/$(bindir) $(DESTDIR)/$(sysconfdir) \
-		$(DESTDIR)/$(sharedir) $(DESTDIR)/$(mandir)/man1 \
-		$(DESTDIR)/$(mandir)/man5
-	for i in $(USR_BIN_FILES); do\
-		install -m 755 $$i $(DESTDIR)/$(bindir)/$$i;\
-	done
-	chmod 4555 $(DESTDIR)/$(prefix)/bin/abuild-sudo
+install: $(USR_BIN_FILES) $(SAMPLES) $(MAN_PAGES) $(AUTOTOOLS_TOOLCHAIN_FILES) default.conf abuild.conf functions.sh
+	install -D -m 755 -t $(DESTDIR)/$(bindir)/ $(USR_BIN_FILES);\
+	chmod 4555 $(DESTDIR)/$(bindir)/abuild-sudo
 	for i in adduser addgroup apk; do \
 		ln -fs abuild-sudo $(DESTDIR)/$(bindir)/abuild-$$i; \
 	done
-	for i in $(MAN_1_PAGES); do\
-		install -m 644 $$i $(DESTDIR)/$(mandir)/man1/$$i;\
-	done
-	for i in $(MAN_5_PAGES); do\
-		install -m 644 $$i $(DESTDIR)/$(mandir)/man5/$$i;\
-	done
+	install -D -m 644 -t $(DESTDIR)/$(mandir)/man1/ $(MAN_1_PAGES);\
+	install -D -m 644 -t $(DESTDIR)/$(mandir)/man5/ $(MAN_5_PAGES);\
 	if [ -n "$(DESTDIR)" ] || [ ! -f "/$(sysconfdir)"/abuild.conf ]; then\
-		install -t $(DESTDIR)/$(sysconfdir)/ abuild.conf; \
+		install -D -m 644 -t $(DESTDIR)/$(sysconfdir)/ abuild.conf; \
 	fi
 
-	install -t $(DESTDIR)/$(prefix)/share/abuild/ $(SAMPLES)
-	install -t $(DESTDIR)/$(prefix)/share/abuild/ $(AUTOTOOLS_TOOLCHAIN_FILES)
-	install -t $(DESTDIR)/$(sharedir)/ functions.sh default.conf
+	install -D -t $(DESTDIR)/$(sharedir)/ $(AUTOTOOLS_TOOLCHAIN_FILES)
+	install -D -m 644 -t $(DESTDIR)/$(sharedir)/ functions.sh default.conf $(SAMPLES)
 
 depends depend:
-	sudo apk --no-cache -U --virtual .abuild-depends add openssl-dev zlib-dev
+	sudo apk --no-cache -U --virtual .abuild-depends add openssl-dev openssl-libs-static zlib-dev
 
 .gitignore: Makefile
 	echo "*.tar.bz2" > $@

abuild-fetch.c

@@ -81,11 +81,22 @@ int fork_exec(char *argv[], int showerr)
 
 static int acquire_lock(const char *lockfile)
 {
-	int lockfd = open(lockfile, O_WRONLY|O_CREAT, 0660);
-	if (lockfd < 0)
-		err(1, "%s", lockfile);
+	int lockfd, i, r;
 
-	if (lockf(lockfd, F_LOCK, 0) == -1)
+	/* try to work around an ESTALE error which occurs on NFS */
+	for (i = 0; i < 10; i++, sleep(1)) {
+		lockfd = open(lockfile, O_WRONLY|O_CREAT, 0660);
+		if (lockfd < 0)
+			err(1, "%s", lockfile);
+
+		r = lockf(lockfd, F_LOCK, 0);
+		if (r == 0 || errno != ESTALE)
+			break;
+
+		close(lockfd);
+	}
+
+	if (r != 0)
 		err(1, "failed to acquire lock: %s", lockfile);
 
 	return lockfd;

abuild-rmtemp.c

@@ -18,7 +18,7 @@
 
 #define PREFIX "/var/tmp/abuild."
 
-static void fail() {
+static void fail(void) {
 	errx(1, "%s", strerror(errno));
 }
 

abuild-sign.in

@@ -18,8 +18,8 @@ fi
 gzip=$(command -v pigz || echo gzip)
 
 do_sign() {
-	local f i keyname repo
-	local openssl=$(command -v openssl || echo libressl)
+	local f i keyname repo openssl
+	openssl=$(command -v openssl || echo libressl)
 
 	# we are actually only interested in the name, not the file itself
 	keyname=${pubkey##*/}
@@ -31,8 +31,8 @@ do_sign() {
 		trap 'die "failed to sign $i"' EXIT
 		set -e
 		cd "$repo"
-		sig=".SIGN.RSA.$keyname"
-		$openssl dgst -sha1 -sign "$privkey" -out "$sig" "$i"
+		sig=".SIGN.$sigtype.$keyname"
+		$openssl dgst $dgstargs -sign "$privkey" -out "$sig" "$i"
 
 		if [ -n "$SOURCE_DATE_EPOCH" ]; then
 			touch -h -d "@$SOURCE_DATE_EPOCH" "$sig"
@@ -61,6 +61,7 @@ usage() {
 		  -k, --private KEY  The private key to use for signing
 		  -p, --public KEY   The name of public key. apk add will look for
 		                     /etc/apk/keys/KEY
+		  -t, --type TYPE    The signature type RSA or RSA256
 		  -q, --quiet
 		  -h, --help         Show this help
 
@@ -72,7 +73,7 @@ privkey="$PACKAGER_PRIVKEY"
 pubkey=
 quiet=
 
-args=$(getopt -o ek:p:qh --long installed,private:,public:,quiet,help -n "$program" -- "$@")
+args=$(getopt -o ek:p:t:qh --long installed,private:,public:,type:,quiet,help -n "$program" -- "$@")
 if [ $? -ne 0 ]; then
 	usage >&2
 	exit 2
@@ -83,6 +84,7 @@ while true; do
 		-e|--installed) check_installed=true;;
 		-k|--private) privkey=$2; shift;;
 		-p|--public) pubkey=$2; shift;;
+		-t|--type) sigtype=$2; shift;;
 		-q|--quiet) quiet=1;; # suppresses msg
 		-h|--help) usage; exit;;
 		--) shift; break;;
@@ -112,6 +114,18 @@ if [ -z "$pubkey" ]; then
 	pubkey=${PACKAGER_PUBKEY:-"${privkey}.pub"}
 fi
 
+if [ -z "$sigtype" ]; then
+	sigtype=RSA
+fi
+
+case $sigtype in
+	RSA) dgstargs="-sha1";;
+	RSA256) dgstargs="-sha256";;
+	*)
+		echo "$program: supported types are RSA and RSA256" >&2
+		exit 1
+		;;
+esac
 if $check_installed; then
 	if ! [ -e "$privkey" ]; then
 		echo "$program: $privkey: File not found" >&2

abuild-sudo.c

@@ -62,7 +62,7 @@ void check_option(const char *opt)
 
 int is_in_group(gid_t group)
 {
-	int ngroups_max = sysconf(_SC_NGROUPS_MAX) + 1;
+	int ngroups_max = getgroups(0, 0);
 	gid_t *buf = malloc(ngroups_max * sizeof(gid_t));
 	int ngroups;
 	int i;
@@ -125,9 +125,11 @@ int main(int argc, const char *argv[])
 
 	argv[0] = path;
 	/* set our uid to root so bbsuid --install works */
-	setuid(0);
+	if (setuid(0) < 0)
+		err(1, "setuid(0) failed");
 	/* set our gid to root so apk commit hooks run with the same gid as for "sudo apk add ..." */
-	setgid(0);
+	if (setgid(0) < 0)
+		err(1, "setgid(0) failed");
 	execv(path, (char * const*)argv);
 	perror(path);
 	return 1;

abuild-tar.c

@@ -221,7 +221,8 @@ static int buf_padto(struct buf *b, size_t alignment)
 	newsize = (oldsize + alignment - 1) & -alignment;
 	if (buf_resize(b, newsize)) return -ENOMEM;
 	b->size = newsize;
-	memset(b->ptr + oldsize, 0, newsize - oldsize);
+	if (b->ptr)
+		memset(b->ptr + oldsize, 0, newsize - oldsize);
 	return 0;
 }
 
@@ -260,6 +261,8 @@ static int buf_add_ext_header_hexdump(struct buf *b, const char *hdr, const unsi
 	for (i = len; i > 9; i /= 10) len++;
 
 	if (buf_resize(b, b->size + len)) return -ENOMEM;
+	if (b->ptr == NULL)
+		return 0;
 	b->size += snprintf(&b->ptr[b->size], len, "%u %s=", len, hdr);
 	for (i = 0; i < valuelen; i++)
 		b->size += snprintf(&b->ptr[b->size], 3, "%02x", (int)value[i]);
@@ -268,22 +271,6 @@ static int buf_add_ext_header_hexdump(struct buf *b, const char *hdr, const unsi
 	return 0;
 }
 
-static void add_legacy_checksum(struct tar_header *hdr, const EVP_MD *md, const unsigned char *digest)
-{
-	struct {
-		char id[4];
-		uint16_t nid;
-		uint16_t size;
-	} mdinfo;
-
-	memcpy(mdinfo.id, "APK2", 4);
-	mdinfo.nid = EVP_MD_nid(md);
-	mdinfo.size = EVP_MD_size(md);
-	memcpy(&hdr->linkname[3], &mdinfo, sizeof(mdinfo));
-	memcpy(&hdr->linkname[3+sizeof(mdinfo)], digest, mdinfo.size);
-	tarhdr_checksum(hdr);
-}
-
 static int do_it(const EVP_MD *md, int cut)
 {
 	char checksumhdr[32];
@@ -320,7 +307,6 @@ static int do_it(const EVP_MD *md, int cut)
 
 			if (hdr.typeflag != '2') {
 				EVP_Digest(data.ptr, size, digest, NULL, md, NULL);
-				add_legacy_checksum(&hdr, md, digest);
 			} else {
 				name_len = strnlen(hdr.linkname, sizeof(hdr.linkname));
 				EVP_Digest(hdr.linkname, name_len, digest, NULL, md, NULL);

abuild.1.scd

@@ -6,8 +6,7 @@ abuild(1)
 
 # SYNOPSIS
 
-*abuild* [options] [-P _REPODEST_] [-s _SRCDEST_] [-D _DESCRIPTION_] [cmd] ...++
-*abuild* [-c] -n _PKGNAME_[-_PKGVER_]
+*abuild* [options] [-P _REPODEST_] [-s _SRCDEST_] [-D _DESCRIPTION_] [cmd] ...
 
 # DESCRIPTION
 
@@ -25,11 +24,11 @@ other related operations.
 *-d*
 	Disable dependency checking
 
-*-D*
+*-D DESCRIPTION*
 	Set APKINDEX description (default: *$repo $(git describe)*)
 
 *-f*
-	Force specified cmd (skip checks: apk up to date, arch, libc)
+	Force specified cmd (skip checks: apk up to date, arch)
 
 *-F*
 	Force run as root
@@ -46,23 +45,28 @@ other related operations.
 *-m*
 	Disable colors (monochrome)
 
-*-P*
+*-P REPODEST*
 	Set REPODEST as the repository location for created packages
 
 *-q*
 	Quiet
 
 *-r*
-	Install missing dependencies from system repository (using sudo)
+	Install missing dependencies from system repository
 
-*-s*
-	Set source package destination directory
+*-s SRCDEST*
+	Set source package destination directory to SRCDEST
 
 *-v*
 	Verbose: show every command as it is run (very noisy)
 
 # COMMANDS
 
+*all*
+	Runs the entire build process. This is the default when no other command is
+	specified, and is roughly an alias for *validate builddeps clean fetch
+	unpack prepare mkusers build check rootpkg*.
+
 *build*
 	Compile and install package into *$pkgdir*.
 
@@ -108,8 +112,8 @@ other related operations.
 *rootpkg*
 	Run 'package', the split functions and create apks as fakeroot
 
-*sanitycheck*
-	Basic sanity check of APKBUILD
+*validate*
+	Basic validation of APKBUILD
 
 *snapshot*
 	Create a *$giturl* snapshot and upload to *$disturl*
@@ -132,6 +136,54 @@ other related operations.
 *verify*
 	Verify checksums
 
+# ENVIRONMENT
+
+*APKBUILD*
+	Override path to *APKBUILD* file.
+
+*BOOTSTRAP*
+	Used when bootstrapping with no existing packages by minimising build
+	dependencies. This flag only has an effect on a few select packages.
+
+	A value of _nocc_ omits any compilation (e.g.: include only source headers).
+	A value of _nolibc_ assumes that no _libc_ is available.
+
+	This list of values is not exhaustive.
+
+*CHOST*
+	Generate packages for given arch or hostspec.
+
+*CTARGET*
+	Generate compiler for given arch or hostspec.
+
+*MOVE_CACHES*
+	Don't use global cache directories for Go and Cargo.
+
+*PACKAGER*
+	Name and email of the packages in RFC5322 format.
+	E.g.: *John Doe <john@example.com>*.
+
+*PACKAGER_PRIVKEY*
+	Path to a private key used to sign packages.
+
+*REPODEST*
+	Packages shall be stored in _$REPODEST/$repo/$pkgname-$pkgver-r$pkgrel.apk_,
+	where *$repo* is the base name of the parent directory of *$startdir*.
+
+*SOURCE_DATE_EPOCH*
+	Use this timestamp as a reference for reproducible builds.
+	See *https://reproducible-builds.org/docs/source-date-epoch/*
+
+*SUDO_APK*
+	Command to use to run apk as root. Defaults to *abuild-apk*.
+
+*USE_CCACHE*
+	If set to a non-empty value, enables *ccache* support.
+
+*USE_COLORS*
+	If set to a non-empty value, print coloured output using ANSI escape
+	sequences.
+
 # FILES
 
 /etc/abuild.conf
@@ -157,7 +209,7 @@ abuild -rc
 # SEE ALSO
 
 SPDX license reference (on the Web at <https://spdx.org/licenses/>),
-newapkbuild(1), apk(8), APKBUILD(5).
+newapkbuild(1), apk(8), APKBUILD(5), abuild.conf(5), buildrepo(1).
 
 # AUTHORS
 

abuild.conf.5.scd

@@ -0,0 +1,29 @@
+abuild.conf(5)
+
+# NAME
+
+*abuild.conf* - configuration file for abuild
+
+# DESCRIPTION
+
+*abuild.conf* is the configuration for the *abuild(1)* program.
+
+# FORMAT
+
+The configuration file is parsed as a shell script; variables are defined as
+regular shell variables.
+
+For a list of supported variables, see the ENVIRONMENT section of the
+*abuild(1)* manual page.
+
+# EXAMPLE
+
+```
+PACKAGER_PRIVKEY="/home/jane/.abuild/jane@example.com-87ac18ca.rsa"
+PACKAGER="Jane Doe <jane@example.com>"
+USE_COLORS=1
+```
+
+# SEE ALSO
+
+abuild(1)

abuild.conf.in

@@ -24,3 +24,6 @@
 
 # what to cleanup after a failed build
 #ERROR_CLEANUP="bldroot deps"
+
+# uncomment to prevent using global cache directories for Go and Cargo
+#MOVE_CACHES=1

abump.1.scd

@@ -0,0 +1,53 @@
+abump(1)
+
+# NAME
+
+*abump* - bump pkgver in an APKBUILD file
+
+# SYNOPSIS
+
+*abump* [-s _CVE-1_,...] [-f _ISSUE_] [-k|--keep] _PKGNAME-1.2.3_
+
+# DESCRIPTION
+
+*abump* updates the *pkgver* in an APKBUILD file, updates its checksums,
+rebuilds it, and finally creates a new commit commit with the changes resulting.
+
+*abump* operates looks for the specified package in nested directories inside
+the current working, assuming a layout like that of the aports repository.
+
+# OPTIONS
+
+*-s, --security CVE1,...*
+	Include CVE in the *secfixes* comment section.
+
+*-f, --fixes ISSUE*
+	Include *Fixes #ISSUE* in the commit message. This will close the upstream
+	issue when the commit is merged into the aports master branch.
+
+*-k, --keep*
+	Keep existing packages.
+
+*-h, --help*
+	Print help information and exit.
+
+# ENVIRONMENT
+
+APORTSDIR
+	Force operating on an alternate directory.
+
+# EXAMPLES
+
+```
+abump mml-1.0.0
+abump glibmm2.68-2.78.0
+abump telegram-desktop-4.11.8
+```
+
+# SEE ALSO
+
+abuild(1), apkgrel(1), newapkbuild(1), APKBUILD(5), apk(8).
+
+# AUTHORS
+
+Natanael Copa <_ncopa@alpinelinux.org_> and open source contributors.

abump.in

@@ -73,8 +73,8 @@ fixes #${fixes#\#}
 		fi
 		msg "$message"
 
-		sed -i -e "s/^pkgver=.*/pkgver=$ver/" \
-			-e "s/^pkgrel=.*/pkgrel=0/" \
+		sed -i -e "s/^pkgver=[^ ]*/pkgver=$ver/" \
+			-e "s/^pkgrel=[^ ]*/pkgrel=0/" \
 			APKBUILD
 
 		$ABUILD $abuild_opts checksum all
@@ -96,7 +96,7 @@ fixes #${fixes#\#}
 usage() {
 	cat <<-__EOF__
 		$program $program_version - bump pkgver in APKBUILDs
-		Usage: $program [-s CVE-1,CVE-2,...] [-f ISSUE] [-R|--recursive] [-k|--keep] PKGNAME-1.2.3 ...
+		Usage: $program [-s CVE-1,CVE-2,...] [-f ISSUE] [-k|--keep] PKGNAME-1.2.3 ...
 		Options:
 		  -s, --security CVE1,CVE-2,...  Security update
 		  -f, --fixes ISSUE              Fixes ISSUE

apkbuild-pypi.in

@@ -4,50 +4,52 @@ use strict;
 use warnings;
 use autodie qw(:all);
 use feature qw(:5.14);
-use experimental 'switch';
 use LWP::UserAgent;
 use LWP::ConnCache;
 use JSON;
+use URI;
+use Text::Wrap qw(wrap $columns);
+use File::Basename qw(dirname);
 
 our $packager = '';
 my %pkgmap = ();
 my %licenses = ();
 
 my $template = <<'EOF';
-# Automatically generated by apkbuild-pypi, template 3
+# Automatically generated by apkbuild-pypi, template 4
 [% authors %]
 pkgname=[% pkgname %]
-#_pkgreal is used by apkbuild-pypi to find modules at PyPI
-_pkgreal=[% pkgreal %]
 pkgver=[% pkgver %]
 pkgrel=[% pkgrel %]
+#_pkgreal is used by apkbuild-pypi to find modules at PyPI
+_pkgreal=[% pkgreal %]
 pkgdesc="[% pkgdesc %]"
-provides="[% provides %]"
-replaces="[% replaces %]"
-url="http://packages.python.org/pypi/[% pkgreal %]"
+url="[% url %]"
 arch="noarch"
 license="[% license %]"
-depends="python3"
-checkdepends="python3-dev"
-makedepends="py3-setuptools"
-subpackages=""
+depends=""
+makedepends="py3-gpep517 py3-setuptools py3-wheel"
+checkdepends="py3-pytest"
+subpackages="$pkgname-pyc"
 source="[% source %]"
-builddir="$srcdir/$_pkgreal-$pkgver"
-
+builddir="[% builddir %]"
+options="[% options %]"[% options_comment %]
+[% compatibility %]
 build() {
-	python3 setup.py build
+	gpep517 build-wheel \
+		--wheel-dir .dist \
+		--output-fd 3 3>&1 >&2
 }
 
 check() {
-	python3 setup.py test
+	python3 -m venv --clear --without-pip --system-site-packages .testenv
+	.testenv/bin/python3 -m installer .dist/*.whl
+	.testenv/bin/python3 -m pytest
 }
 
 package() {
-	PYTHONPATH=$pkgdir`python3 -c "import site; print(site.getsitepackages()[0])"` \
-	python3 setup.py install \
-		--prefix=/usr \
-		--root="$pkgdir" \
-		--single-version-externally-managed
+	python3 -m installer -d "$pkgdir" \
+		.dist/*.whl
 }
 
 EOF
@@ -73,14 +75,31 @@ sub read_assignments_from_file {
     my %mline = $text =~ /^(\w+)\s*=\s*\"([^\"]*)\".*$/mg;
     my %hash = ( %sline, %mline );
 
-    my $authors = join("\n", $text =~ /^# Contributor: .*$/mg, $text =~ /^# Maintainer: .*$/mg);
+    return \%hash if $filename ne 'APKBUILD';
+    my $authors = join( "\n",
+        $text =~ /^# Contributor: .*$/mg,
+        $text =~ /^# Maintainer: .*$/mg );
     $hash{'authors'} = $authors if length($authors) > 1;
 
-    my $provides = $text =~ m/provides=\"(.*)\"".*/mg;
-    $hash{'provides'} = $1 if length($provides) >= 1;
+    if ($text =~ m/^provides=\"(.*)\"(.*)$/m) {
+        $hash{'provides'} = $1;
+        $hash{'provides_comment'} = $2;
+    }
 
-    my $requires = $text =~ m/^requires=\"(.*)\"".*$/mg;
-    $hash{'requires'} = $1 if length($requires) >= 1;
+    if ($text =~ m/^replaces=\"(.*)\"(.*)$/m) {
+        $hash{'replaces'} = $1;
+        $hash{'replaces_comment'} = $2;
+    }
+
+    # workaround for `builddir="$srcdir"/$_pkgname-$pkgver`
+    if ($text =~ m/^builddir=\"(.*)\"([^\s]*)/m) {
+        $hash{'builddir'} = $1 . $2;
+    }
+
+    if ($text =~ m/^options=\"(.*)\"(.*)$/m) {
+        $hash{'options'} = $1;
+        $hash{'options_comment'} = $2;
+    }
 
     return \%hash;
 }
@@ -94,6 +113,7 @@ sub map_pypi_to_apk {
 sub map_license {
     my ($license) = @_;
 
+    $license //= '';
     $license =~ s/ or / /g;
 
     return $license;
@@ -101,48 +121,131 @@ sub map_license {
 
 sub get_source {
     my ($distdata) = @_;
+    my $pkgname = $distdata->{info}{name};
 
+    my $source;
     for my $url (@{$distdata->{urls}}) {
-        return $url->{url} if $url->{python_version} eq 'source'
+        if ($url->{python_version} eq 'source') {
+            $source = URI->new($url->{url});
+            last;
+        }
+    }
+    die "Unable to locate sources for $pkgname.\n" unless $source;
+
+    my $filename = ($source->path_segments)[-1];
+    my $pretty_path = substr($pkgname, 0, 1) . "/$pkgname";
+    my $pretty_url = $source->clone;
+    $pretty_url->path("/packages/source/$pretty_path/$filename");
+
+    my $response = $ua->head($pretty_url);
+    if ($response->is_success) {
+        return $pretty_url->as_string;
+    } else {
+        return $source->as_string;
     }
-    die "Unable to locate sources for $distdata->{name}.\n";
 }
 
 sub read_apkbuild {
     return read_assignments_from_file('APKBUILD');
 }
 
+sub format_line {
+    my $line = shift;
+    return "\t" . $line . "\n";
+}
+
+sub format_source {
+    my $srcurl   = shift;
+    my $orig_src = shift;
+
+    $orig_src =~ s/^\s+//mg;
+    $orig_src =~ s/\s+/ /g;
+
+    my @sources = split (/\s/, $orig_src);
+
+    return $srcurl if @sources <= 1;
+
+    shift @sources if $sources[0] =~ m/pkgver/;
+    my $patches;
+    for my $patch (@sources) {
+        next if $patch eq "";
+        $patches .= format_line($patch);
+    }
+
+    return $srcurl . "\n" . ($patches // '') . "\t";
+}
+
 sub write_apkbuild {
     my ($distdata, $apkbuild) = @_;
 
     my $replaces = undef;
     my $provides = undef;
     my $authors = undef;
+    my $license = undef;
+    my $url = undef;
+    my $pkgname = undef;
+    my $pkgdesc = undef;
     my $pkgrel = 0;
+    my $builddir = undef;
+    my $options = undef;
+    my $options_comment = undef;
+    my $orig_source = "";
+
+    if (our $use_homepage) {
+        $url =
+          $distdata->{info}{project_urls}{Homepage}
+          || $distdata->{info}{home_page};
+    }
 
     if (defined $apkbuild) {
         $authors = $apkbuild->{authors};
         $provides = $apkbuild->{provides};
         $replaces = $apkbuild->{replaces};
+        $license = $apkbuild->{license};
+        $url = $apkbuild->{url};
+        $pkgname = $apkbuild->{pkgname};
+        $pkgdesc = $apkbuild->{pkgdesc};
         $pkgrel = $apkbuild->{pkgrel};
+        $builddir = $apkbuild->{builddir};
+        $options  = $apkbuild->{options} if defined $apkbuild->{options};
+        $options_comment  = $apkbuild->{options_comment} if defined $apkbuild->{options_comment};
+        $orig_source      = $apkbuild->{source};
 
 	if ($apkbuild->{pkgver} eq $distdata->{info}{version}) {
 	    $pkgrel++;
 	}
     }
 
+    my $pkgreal = $distdata->{info}{name};
+    my $srcurl = get_source($distdata);
+
     my %repl = (
 	authors  => ($authors or "# Contributor: $packager\n# Maintainer: $packager"),
-        pkgname  => map_pypi_to_apk($distdata->{info}{name}),
-        pkgreal  => $distdata->{info}{name},
+        pkgname  => ($pkgname or map_pypi_to_apk($pkgreal)),
+        pkgreal  => $pkgreal,
         pkgver   => $distdata->{info}{version},
         pkgrel	 => $pkgrel,
-        source   => get_source($distdata),
-        license  => map_license($distdata->{info}{license}),
-        pkgdesc  => $distdata->{info}{summary},
-        provides => ($provides or ''),
-        replaces => ($replaces or ''),
+        source   => format_source($srcurl, $orig_source),
+        license  => ($license or map_license($distdata->{info}{license})),
+        url      => ($url or "https://pypi.org/project/${pkgreal}/"),
+        pkgdesc  => ($pkgdesc or $distdata->{info}{summary} or "Python module for $pkgreal"),
+        builddir => ($builddir or ''),
+        options  => ($options or ''),
+        options_comment => ($options_comment or ''),
     );
+
+    $repl{compatibility} = "";
+    if ($replaces) {
+        my $comment = $apkbuild->{'replaces_comment'} // '';
+        $repl{compatibility} .= "\nreplaces=\"$replaces\"" . $comment;
+    }
+    if ($provides) {
+        my $comment = $apkbuild->{'provides_comment'} // '';
+        $repl{compatibility} .= "\nprovides=\"$provides\"" . $comment;
+    }
+    $repl{compatibility} .= "\n" if $replaces or $provides;
+
+    $repl{source} =~ s/-$repl{pkgver}/-\$pkgver/g;
     $template =~ s/\[% (.*?) %\]/$repl{$1}/g;
 
     open my $fh, '>:utf8', 'APKBUILD';
@@ -154,8 +257,15 @@ sub write_apkbuild {
     return \%repl;
 }
 
+sub unpack_source {
+    system('abuild checksum unpack');
+}
+
 sub prepare_tree {
-    system('abuild checksum unpack prepare');
+    my %options = @_;
+
+    unpack_source if $options{unpack};
+    system('abuild prepare');
 }
 
 sub find_package_name {
@@ -188,42 +298,172 @@ sub find_package_name {
 
 sub get_data {
     my ($package) = @_;
-    my $response = $ua->get("https://pypi.python.org/pypi/$package/json");
+    my $response = $ua->get("https://pypi.org/pypi/$package/json");
     $response->is_success or die $response->status_line;
     my $distdata = $json->decode($response->decoded_content);
 
     return $distdata;
 }
 
-sub get_deps {
-    my ($data) = @_;
+sub parse_requires_dist {
+    my $reqs = shift;
 
-    chdir "src/$data->{pkgreal}-$data->{pkgver}";
-    my $reqs = `python3 ./setup.py --requires`;
+    # Valid PyPI regex: https://peps.python.org/pep-0508/#names
+    my $pypi_regex = qr/(?i)([A-Z0-9][A-Z0-9][A-Z0-9._-]*[A-Z0-9])/;
 
-    my @reqs = split /\n/, $reqs;
+    my @depends =
+        map { m/$pypi_regex/; $1 || () }
+        grep { $_ !~ m/; extra ==/ }
+        @$reqs;
 
-    foreach my $i (0 .. $#reqs) {
-        $reqs[$i] =~ s/(\(|\s+).*$//;
-        $reqs[$i] = map_pypi_to_apk($reqs[$i]);
+    my @checkdeps =
+        map { m/$pypi_regex/; $1 || () }
+        grep { m/; extra == ["'](tests|pytest)["']/ }
+        @$reqs;
+
+    my %reqs = (
+	depends    => \@depends,
+	checkdeps  => \@checkdeps,
+    );
+
+    return \%reqs;
+}
+
+sub format_depends {
+    my $deps = shift;
+
+    $columns = 102;
+
+    $deps =~ s/ {2,}/ /g;
+    $deps =~ s/^\s//g;
+    $deps =~ s/\s$//g;
+
+    if ( length($deps) >= $columns ) {
+        $deps = wrap( "\t", "\t", $deps );
     }
+    $deps =~ s/\s$//g;
 
-    chdir '../..';
+    if ( length($deps) >= $columns ) {
+        $deps = "\n" . $deps . "\n\t";
+    }
+    return $deps;
+}
+
+sub get_deps {
+    my ($distdata, $data) = @_;
+
+    my $reqs = parse_requires_dist($distdata->{info}{requires_dist});
+    my %depends = ('py3-pytest' => 'py3-pytest');
+
+    my @depends =
+        map {
+            my $apkname = map_pypi_to_apk($_);
+            if (exists $depends{$apkname}) { () }
+            else { $depends{$apkname} = $apkname }
+        }
+        @{$reqs->{depends}};
+
+    my @checkdeps =
+        map {
+            my $apkname = map_pypi_to_apk($_);
+            exists($depends{$apkname}) ? () : $apkname
+        }
+        @{$reqs->{checkdeps}};
 
     my $apk = read_file('APKBUILD');
 
-    $reqs = join ' ', @reqs;
+    my $depends = format_depends(join ' ', @depends);
 
-    $apk =~ s/pymakedepends=""/pymakedepends="$reqs"/;
+    $apk =~ s/^depends=""/depends="$depends"/m;
+
+    unshift @checkdeps, 'py3-pytest';
+    my $checkdeps = format_depends(join ' ', @checkdeps);
+
+    $apk =~ s/^checkdepends="py3-pytest"/checkdepends="$checkdeps"/m;
 
     # remove empty variables
-    $apk =~ s/.*=""\n//g;
+    $apk =~ s/.*="".{0,}\n//g;
 
     open my $fh, '>:utf8', 'APKBUILD';
 
     print $fh $apk;
 
-    say "Requires: $reqs";
+    say "Requires: @depends\n\nCheckDepends: @checkdeps";
+}
+
+sub write_old_deps {
+    my ($data, $apkbuild) = @_;
+
+    my $apk = read_file('APKBUILD');
+
+    if (my $depends = $apkbuild->{depends}) {
+        $apk =~ s/^depends=".*"/depends="$depends"/m;
+    }
+
+    if (my $makedeps = $apkbuild->{makedepends}) {
+        if ($makedeps =~ m/py3-gpep517/) {
+           $apk =~ s/^makedepends=".*"/makedepends="$makedeps"/m;
+        } else {
+           $apk =~ s/^makedepends="(.*)"/makedepends="$1 $makedeps"/m;
+        }
+    }
+
+    if (my $checkdeps = $apkbuild->{checkdepends}) {
+        if ($checkdeps =~ m/py3-pytest/) {
+            $apk =~ s/^checkdepends=".*"/checkdepends="$checkdeps"/m;
+        } else {
+            $apk =~ s/^checkdepends="(.*)"/checkdepends="$1 $checkdeps"/m;
+        }
+    }
+
+    # remove empty variables
+    $apk =~ s/.*="".{0,}\n//g;
+
+    open my $fh, '>:utf8', 'APKBUILD';
+
+    print $fh $apk;
+}
+
+sub update_builddir {
+    my $apkbuild = read_apkbuild;
+    my $pkgreal = $apkbuild->{'_pkgreal'};
+    my $pkgname = $apkbuild->{pkgname};
+    my $pkgver = $apkbuild->{pkgver};
+    my $oldbuilddir = $apkbuild->{builddir};
+
+    my $build_path = glob("
+      src/*${pkgver}/pyproject.toml
+      src/*${pkgver}/setup.py
+    ");
+
+    if ($build_path) {
+        my $newbuilddir = dirname($build_path);
+
+        $newbuilddir =~ s/src/\$srcdir/;
+        $newbuilddir =~ s/$pkgreal/\$_pkgreal/;
+        $newbuilddir =~ s/$pkgver/\$pkgver/;
+
+        my $apk = read_file('APKBUILD');
+
+        if ($pkgname eq $pkgreal and
+          $newbuilddir eq '$srcdir/$_pkgreal-$pkgver') {
+            # this will be deleted by the remove empty
+            # variables regex in get_deps/write_old_deps
+            $apk =~ s/^builddir=".*"/builddir=""/m;
+
+            $newbuilddir = '<same as default, deleted>';
+        } elsif ($newbuilddir eq $oldbuilddir) {
+            return;
+        } else {
+            $apk =~ s/^builddir=".*"/builddir="$newbuilddir"/m;
+        }
+
+        print "\n\$builddir redefined:\n\t",
+            "OLD: $oldbuilddir, NEW: $newbuilddir\n\n";
+
+        open my $fh, '>:utf8', 'APKBUILD';
+        print $fh $apk;
+    }
 }
 
 my $abuild_conf = read_assignments_from_file('/etc/abuild.conf');
@@ -234,95 +474,104 @@ $packager = $user_abuild_conf->{PACKAGER} if $user_abuild_conf->{PACKAGER};
 
 sub usage {
     say <<'EOF';
-Usage: apkbuild-pypi [create <package> | check | recreate | upgrade | update]
+Usage: apkbuild-pypi [create <package> [homepage] | check | recreate [deps] | upgrade | update]
 
 In the repository root:
     create <package>: Creates an APKBUILD for <package>
+    create <package> homepage: Creates an APKBUILD for <package> with url= field set to project homepage, if available
 
 In the package root:
     check           : Reports current & latest version of the package
-    recreate        : Recreates the APKBUILD
+    recreate [deps] : Recreates the APKBUILD [also recalculate dependencies]
     upgrade         : Upgrades to the latest version of the package
     update          : Updates APKBUILD metadata
 EOF
 }
 
-given ($ARGV[0]) {
-    when ('create') {
-        my $package = $ARGV[1];
-        $package or die usage;
+if (! defined $ARGV[0]) {
+    die usage;
+} elsif ($ARGV[0] eq 'create') {
+    my $package = $ARGV[1];
+    $package or die usage;
 
-        my $distdata = get_data($package);
-        my $apkname = map_pypi_to_apk($package);
+    my $distdata = get_data($package);
+    my $apkname = map_pypi_to_apk($package);
 
-        mkdir $apkname;
-        chdir $apkname;
+    mkdir $apkname;
+    chdir $apkname;
 
-        my $data = write_apkbuild($distdata, undef);
-        prepare_tree;
+    if ($ARGV[2] and $ARGV[2] eq 'homepage') { our $use_homepage = 1; }
 
-        get_deps($data);
-    } when ('recreate') {
-        my $apkbuild = read_apkbuild;
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-        my $distdata = get_data($apkbuild->{_pkgreal});
-	my $pkgver = $distdata->{info}{version} =~ s/^[^0-9]+//r;
-	if ($pkgver ne $apkbuild->{pkgver}) {
-		#Reset pkgrel on upgrade on recreate
-		say "Upgrading PyPI module from $apkbuild->{pkgver} to $pkgver";
-		$apkbuild->{pkgrel}=0;
-	}
-	my $data = write_apkbuild($distdata, $apkbuild);
+    my $data = write_apkbuild($distdata, undef);
+    unpack_source;
+    update_builddir;
 
-        prepare_tree;
-        get_deps($data);
-    } when ('upgrade') {
-        my $apkbuild = read_apkbuild;
-
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-
-        my $distdata = get_data($apkbuild->{_pkgreal});
-
-        my $pkgver = $distdata->{info}{version};
-
-        if ($pkgver ne $apkbuild->{pkgver}) {
-            say "Upgrading PyPI package from $apkbuild->{pkgver} to $pkgver";
-
-            my $text = read_file('APKBUILD');
-
-            $text =~ s/^(pkgver)=.*$/$1=$pkgver/mg or
-                die "Can't find pkgver line in APKBUILD";
-            $text =~ s/^(pkgrel)=.*$/$1=0/mg or
-                die "Can't find pkgrel line in APKBUILD";
-
-            open my $fh, '>:utf8', 'APKBUILD';
-            print $fh $text;
-            close $fh;
-        } else {
-            say "Already up to date with PyPI";
-        }
-    } when ('check') {
-        my $apkbuild = read_apkbuild;
-
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-        my $distdata = get_data($apkbuild->{_pkgreal});
-
-        my $pkgver = $distdata->{info}{version};
-
-
-        say "$apkbuild->{pkgname}: Latest version: $pkgver Packaged version: $apkbuild->{pkgver}";
-        if ($pkgver ne $apkbuild->{pkgver}) {
-            exit(1);
-        }
-    } when ('update') {
-        prepare_tree;
-    } default {
-        die usage;
+    get_deps($distdata, $data);
+    prepare_tree( unpack => 0 );
+} elsif ($ARGV[0] eq 'recreate') {
+    my $apkbuild = read_apkbuild;
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
     }
+    my $distdata = get_data($apkbuild->{_pkgreal});
+    my $pkgver = $distdata->{info}{version} =~ s/^[^0-9]+//r;
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        #Reset pkgrel on upgrade on recreate
+        say "Upgrading PyPI module from $apkbuild->{pkgver} to $pkgver";
+        $apkbuild->{pkgrel}=0;
+    }
+
+    my $data = write_apkbuild($distdata, $apkbuild);
+    unpack_source;
+    update_builddir;
+
+    if ($ARGV[1] and $ARGV[1] eq 'deps') { get_deps($distdata, $data); }
+    else { write_old_deps($data, $apkbuild); }
+    prepare_tree( unpack => 0 );
+} elsif ($ARGV[0] eq 'upgrade') {
+    my $apkbuild = read_apkbuild;
+
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
+    }
+
+    my $distdata = get_data($apkbuild->{_pkgreal});
+
+    my $pkgver = $distdata->{info}{version};
+
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        say "Upgrading PyPI package from $apkbuild->{pkgver} to $pkgver";
+
+        my $text = read_file('APKBUILD');
+
+        $text =~ s/^(pkgver)=.*$/$1=$pkgver/mg or
+            die "Can't find pkgver line in APKBUILD";
+        $text =~ s/^(pkgrel)=.*$/$1=0/mg or
+            die "Can't find pkgrel line in APKBUILD";
+
+        open my $fh, '>:utf8', 'APKBUILD';
+        print $fh $text;
+        close $fh;
+    } else {
+        say "Already up to date with PyPI";
+    }
+} elsif ($ARGV[0] eq 'check') {
+    my $apkbuild = read_apkbuild;
+
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
+    }
+    my $distdata = get_data($apkbuild->{_pkgreal});
+
+    my $pkgver = $distdata->{info}{version};
+
+
+    say "$apkbuild->{pkgname}: Latest version: $pkgver Packaged version: $apkbuild->{pkgver}";
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        exit(1);
+    }
+} elsif ($ARGV[0] eq 'update') {
+    prepare_tree( unpack => 1 );
+} else {
+    die usage;
 }

bootchartd

@@ -132,7 +132,7 @@ finalize()
 		fi
 
 		# Get CPU count
-		local cpucount=$(grep -c '^processor' /proc/cpuinfo)
+		cpucount=$(grep -c '^processor' /proc/cpuinfo || [ $? -eq 1 ])
 		if [ $cpucount -gt 1 -a -n "$(grep 'sibling.*2' /proc/cpuinfo)" ]; then
 			# Hyper-Threading enabled
 			cpucount=$(( $cpucount / 2 ))

checkapk.in

@@ -17,21 +17,41 @@ fi
 
 
 usage() {
-	cat >&2 <<-__EOF__
+	cat <<-__EOF__
 		$program $program_version - find ABI breakages in package upgrades
-		Usage: $program
+		Usage: $program [-h|--help]
 
 		Run in the directory of a built package.
 
+		Options:
+		  -h, --help  Print this help
+
 	__EOF__
 }
 
+args=$(getopt -o h --long help \
+	-n "$program" -- "$@")
+
+if [ $? -ne 0 ]; then
+	usage >&2
+	exit 2
+fi
+eval set -- "$args"
+while true; do
+	case $1 in
+		-h|--help) usage; exit 0;;
+		--) shift; break;;
+		*) exit 1;; # getopt error
+	esac
+	shift
+done
+
 if [ $# -gt 0 ]; then
-	usage
+	usage >&2
 	exit 2
 fi
 
-if ! [ -f "$ABUILD_CONF" ] && ! [ -f "$ABUILD_USERCONF" ]; then
+if ! [ -f "$ABUILD_CONF" ] && ! [ -f "$ABUILD_USERCONF" ] && ! [ -f "$ABUILD_DEFCONF" ]; then
 	die "no abuild.conf found"
 fi
 
@@ -47,9 +67,15 @@ fi
 
 startdir="$PWD"
 tmpdir=$(mktemp -d -t checkpkg-script.XXXXXX)
-trap "rm -rf '$tmpdir'" INT EXIT
+trap "rm -rf '$tmpdir'; exit" INT EXIT
 cd "$tmpdir" || die "failed to create temp dir"
 
+# storage for downloaded/copied apks
+mkdir -p apks
+
+# default to pigz for unpacking
+gunzip="$(command -v pigz || echo gzip) -d"
+
 for i in $pkgname $subpackages; do
 	_pkgname=${i%%:*}
 	pkg=${_pkgname}-$pkgver-r$pkgrel
@@ -65,18 +91,23 @@ for i in $pkgname $subpackages; do
 	[ -f "$filepath" ] || die "can't find $pkgfile"
 
 	# generate a temp repositories file with only the http(s) repos
-	grep -E "^https?:" /etc/apk/repositories > $tmpdir/repositories
+	grep -E "^https?:" /etc/apk/repositories > "$tmpdir"/repositories
 
-	oldpkg=$(apk fetch --repositories-file $tmpdir/repositories --simulate $_pkgname 2>&1 | sed 's/^Downloading //')
+	oldpkg=$(apk fetch --repositories-file "$tmpdir"/repositories --simulate $_pkgname 2>&1 | sed 's/^Downloading //')
 	if [ "${oldpkg}" = "${pkg}" ]; then
 		die "the built package ($_pkgname) is already in the repo"
 	fi
 
-	# For our local repo (newsize) apk info might return multiple packages, e.g. if different
-	# version of the package where build previously. Filter out this specific pkgver using awk.
-	newsize=$(apk info --repositories-file /dev/null --repository "$REPODEST"/$repo --size $_pkgname | \
-		awk "/^${pkg//+/\\+}/ { found = 1 } /^[0-9]+/ { if (found) { print \$0; exit } }")
-	oldsize=$(apk info --repositories-file $tmpdir/repositories --size $_pkgname | awk '/^[0-9]+/ { print $0 }' | head -1)
+	# apk info could return multiple lines if multiple packages share a provide
+	# (e.g. dnsmasq); filter with the exact package name and take the second line:
+	#  7zip-23.01-r0 installed size:
+	#  1668 KiB
+	newsize="$(apk info --repositories-file /dev/null --repository "$REPODEST"/$repo --size $_pkgname | \
+		grep -F "$pkg" -A1 | \
+		tail -n1)"
+	oldsize="$(apk info --repositories-file "$tmpdir"/repositories --size "$_pkgname" | \
+		grep -F "$oldpkg" -A1 | \
+		tail -n1)"
 
 	if [ "$oldsize" = "$newsize" ]; then
 		msg "No size differences for $_pkgname."
@@ -84,22 +115,42 @@ for i in $pkgname $subpackages; do
 		msg "Size difference for $_pkgname: $oldsize -> $newsize"
 	fi
 
-	apk fetch --quiet --repositories-file $tmpdir/repositories --stdout $_pkgname \
-		| tar -zt | grep -v '^\.SIGN\.' | sort > filelist-$_pkgname-old \
-		|| die "failed to download old pkg, maybe run 'apk update'?"
+	apk fetch --quiet --repositories-file "$tmpdir"/repositories --stdout "$_pkgname" > apks/old.apk \
+		|| msg2 "Old apk for $_pkgname missing. (new package/arch? broken internet?)"
 
-	tar -ztf "$filepath" | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname"
+	# pre-uncompress to not decompress twice
+	# we do a decompression + tar -t for the file list, but then later we might do a full extraction for sodiff.
+	# to not decompress here and then later again, store the intermediate tar
+	$gunzip -c 2>/dev/null < apks/old.apk > apks/old.tar &
+	$gunzip -c "$filepath" < "$filepath" > apks/new.tar &
+	wait
+	tar -t -f apks/old.tar 2>/dev/null | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname-old" &
+	tar -t -f apks/new.tar | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname-new" &
+	wait
 
-	diff -u "filelist-$_pkgname-old" "filelist-$_pkgname"
+	diff -U3 "filelist-$_pkgname-old" "filelist-$_pkgname-new"
 
-	if diff "filelist-$_pkgname-old" "filelist-$_pkgname" | grep '\.so' > /dev/null 2>&1; then
-		mkdir -p pkg
-		cd pkg
-		tar -zxf "$filepath" > /dev/null
-		diff "../filelist-$_pkgname-old" "../filelist-$_pkgname" | awk '/>.*\.so/{$1 = ""; print $0}' | while read i; do
-			echo "${i}: " "$(objdump -p "$i" | grep SONAME)"
+	if diff -U0 "filelist-$_pkgname-old" "filelist-$_pkgname-new" | grep -q '\.so'; then
+		echo "SODIFF:"
+
+		mkdir -p "$_pkgname-pkg-old" "$_pkgname-pkg-new"
+		tar -C "$_pkgname-pkg-old" 2>/dev/null -x -f apks/old.tar > /dev/null &
+		tar -C "$_pkgname-pkg-new" -x -f apks/new.tar > /dev/null &
+		wait
+
+		# filter to things that start with -+ but strip the header (---/+++)
+		diff -U0 "filelist-$_pkgname-old" "filelist-$_pkgname-new" | grep -E '^(\+|-)[A-Za-z0-9]+' | grep '\.so' | while read -r diff_sofile; do
+			case "$diff_sofile" in
+			-*) path="$_pkgname-pkg-old"; sofile="${diff_sofile#\-}" ;;
+			+*) path="$_pkgname-pkg-new"; sofile="${diff_sofile#\+}" ;;
+			esac
+
+			# skip symlinks (only adds duplicate output or is dangling), and things that aren't valid elfs
+			# matching .so above matches anything with .so in the name, e.g. xyz.sourceforge
+			if ! [ -L "$path"/"$sofile" ] && readelf -h "$path"/"$sofile" >/dev/null 2>&1; then
+				echo "$diff_sofile: " "$(objdump -p "$path"/"$sofile" | grep SONAME)"
+			fi
 		done
-		cd ..
 	else
 		msg "No soname differences for $_pkgname."
 	fi

default.conf

@@ -1,5 +1,6 @@
-export CFLAGS="-Os -Wformat -Werror=format-security"
-export CXXFLAGS="-Os -Wformat -Werror=format-security -D_GLIBCXX_ASSERTIONS=1"
+export CFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security"
+export CXXFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security"
+export CXXFLAGS="$CXXFLAGS -D_GLIBCXX_ASSERTIONS=1 -D_LIBCPP_ENABLE_THREAD_SAFETY_ANNOTATIONS=1 -D_LIBCPP_ENABLE_HARDENED_MODE=1"
 export LDFLAGS="-Wl,--as-needed,-O1,--sort-common"
 export GOFLAGS="-buildmode=pie -modcacherw -trimpath -buildvcs=false"
 # Do note that these should work with at least GDC and LDC
@@ -9,6 +10,7 @@ export JOBS=$(nproc)
 export MAKEFLAGS=-j$JOBS
 export SAMUFLAGS=-j$JOBS
 export CARGO_BUILD_JOBS=$JOBS
+export CMAKE_BUILD_PARALLEL_LEVEL=$JOBS
 export CTEST_PARALLEL_LEVEL=$JOBS
 
 export CARGO_PROFILE_RELEASE_OPT_LEVEL="s"
@@ -17,17 +19,17 @@ export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
 export CARGO_PROFILE_RELEASE_LTO="true"
 export CARGO_REGISTRIES_CRATES_IO_PROTOCOL="sparse"
 
+export CTEST_OUTPUT_ON_FAILURE=ON
+export CTEST_NO_TESTS_ACTION=error
+
+export PERL_MM_USE_DEFAULT=1
+
 SRCDEST=/var/cache/distfiles
 
 # The package will be stored as $REPODEST/$repo/$pkgname-$pkgver-r$pkgrel.apk
 # where $repo is the name of the parent directory of $startdir.
 REPODEST=$HOME/packages/
 
-# PACKAGER and MAINTAINER are used by newapkbuild when creating new aports for
-# the APKBUILD's "Contributor:" and "Maintainer:" comments, respectively.
-#PACKAGER="Your Name <your@email.address>"
-#MAINTAINER="$PACKAGER"
-
 # what to clean up after a successful build
 CLEANUP="srcdir bldroot pkgdir deps"
 

functions.sh.in

@@ -64,7 +64,7 @@ hostspec_to_libc() {
 }
 
 readconfig() {
-	local _APORTSDIR _BUILDDIR _PKGDEST _SRCPKGDEST _REPODEST _SRCDEST
+	local _APORTSDIR _BUILDDIR _PKGDEST _SRCPKGDEST _REPODEST _SRCDEST _ABUILD_USERDIR
 	local _CC=gcc _CXX=g++ _LD=ld _CARCH _CHOST _CTARGET _CPPFLAGS _CFLAGS _CXXFLAGS _LDFLAGS
 	local _JOBS _MAKEFLAGS _PACKAGER _USE_COLORS _USE_CCACHE
 	local _BUILDCC _BUILDCXX _BUILDLD _BUILDCPPFLAGS _BUILDCXXFLAGS _BUILDCFLAGS
@@ -76,6 +76,7 @@ readconfig() {
 	[ -n "${SRCPKGDEST+x}" ] && _SRCPKGDEST=$SRCPKGDEST
 	[ -n "${REPODEST+x}" ] && _REPODEST=$REPODEST
 	[ -n "${SRCDEST+x}" ] && _SRCDEST=$SRCDEST
+	[ -n "${ABUILD_USERDIR+x}" ] && _ABUILD_USERDIR=$ABUILD_USERDIR
 	[ -n "${CC+x}" ] && _CC=$CC
 	[ -n "${CXX+x}" ] && _CXX=$CXX
 	[ -n "${LD+x}" ] && _LD=$LD
@@ -98,11 +99,11 @@ readconfig() {
 	[ -n "${USE_COLORS+x}" ] && _USE_COLORS="$USE_COLORS"
 	[ -n "${USE_CCACHE+x}" ] && _USE_CCACHE="$USE_CCACHE"
 	: ${ABUILD_DEFCONF:=${ABUILD_SHAREDIR:-$sharedir}/default.conf}
-	: ${ABUILD_CONF:=$sysconfdir/abuild.conf}
-	: ${ABUILD_USERDIR:=$HOME/.abuild}
-	: ${ABUILD_USERCONF:=$ABUILD_USERDIR/abuild.conf}
 	[ -f "$ABUILD_DEFCONF" ] && . "$ABUILD_DEFCONF"
+	: ${ABUILD_CONF:=$sysconfdir/abuild.conf}
 	[ -f "$ABUILD_CONF" ] && . "$ABUILD_CONF"
+	ABUILD_USERDIR=${_ABUILD_USERDIR-${ABUILD_USERDIR:-$HOME/.abuild}}
+	: ${ABUILD_USERCONF:=$ABUILD_USERDIR/abuild.conf}
 	[ -f "$ABUILD_USERCONF" ] && . "$ABUILD_USERCONF"
 	APORTSDIR=${_APORTSDIR-$APORTSDIR}
 

newapkbuild.in

@@ -32,7 +32,7 @@ is_github_url() {
 
 prepare_rust() {
 	cat >>APKBUILD<<__EOF__
-	cargo fetch --target="$CTARGET" --locked
+	cargo fetch --target="\$CTARGET" --locked
 __EOF__
 }
 
@@ -84,14 +84,14 @@ build_meson() {
 
 	cat >>APKBUILD<<__EOF__
 	abuild-meson \\
-		. output
+		output .
 	meson compile -C output
 __EOF__
 }
 
 build_perl() {
 	cat >>APKBUILD<<__EOF__
-	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor
+	perl Makefile.PL INSTALLDIRS=vendor
 	make
 __EOF__
 }
@@ -105,7 +105,7 @@ __EOF__
 build_python_gpep517() {
 	cat >>APKBUILD<<__EOF__
 	gpep517 build-wheel \\
-		--wheel-dir dist \\
+		--wheel-dir .dist \\
 		--output-fd 3 3>&1 >&2
 __EOF__
 }
@@ -118,7 +118,8 @@ __EOF__
 
 build_empty() {
 	cat >>APKBUILD<<__EOF__
-	# Replace with proper build command(s)
+	# Replace with proper build command(s).
+	# Remove if there is no build command.
 	:
 __EOF__
 }
@@ -132,7 +133,7 @@ __EOF__
 
 check_cmake() {
 	cat >>APKBUILD<<__EOF__
-	ctest --test-dir build --output-on-failure
+	ctest --test-dir build
 __EOF__
 }
 
@@ -144,15 +145,16 @@ __EOF__
 
 check_python_gpep517() {
 	cat >>APKBUILD<<__EOF__
-	python3 -m venv --clear --without-pip --system-site-packages testenv
-	testenv/bin/python3 -m installer dist/*.whl
-	testenv/bin/python3 -m pytest
+	python3 -m venv --clear --without-pip --system-site-packages .testenv
+	.testenv/bin/python3 -m installer .dist/*.whl
+	.testenv/bin/python3 -m pytest
 __EOF__
 }
 
 check_empty() {
 	cat >>APKBUILD<<__EOF__
-	# Replace with proper check command(s)
+	# Replace with proper check command(s).
+	# Remove and add !check option if there is no check command.
 	:
 __EOF__
 }
@@ -208,7 +210,7 @@ __EOF__
 package_python_gpep517() {
 	cat >>APKBUILD<<__EOF__
 	python3 -m installer -d "\$pkgdir" \\
-		dist/*.whl
+		.dist/*.whl
 __EOF__
 }
 
@@ -230,7 +232,7 @@ __EOF__
 newaport() {
 	local newname="${1##*/}"
 	local pn=${newname%[-_][0-9]*}
-	local pv
+	local prearchive postarchive pv
 	local source=
 	is_url "$1" && source="$1"
 
@@ -241,6 +243,10 @@ newaport() {
 		fi
 		pv=${newname%.t*} #strip .tar.gz .tgz .tar.bz2 etc
 		pv=${pv#*[a-z]}
+		prearchive=${source%/archive/*}
+		postarchive=${source#*/archive/}
+		postarchive=${postarchive#refs/tags/}
+		source="${prearchive}/archive/${postarchive}"
 		source="${source%.t*}/$pkgname-$pv.tar.gz"
 	elif [ "$pn" != "$newname" ]; then
 		pv=${newname#$pn[-_]}

sample.APKBUILD

@@ -1,7 +1,5 @@
 # This is an example APKBUILD file. Use this as a start to creating your own,
 # and remove these comments.
-# NOTE: Please fill out the license field for your package! If it is unknown,
-# then please put 'unknown'.
 
 # Contributor: Your Name <youremail@domain.com>
 # Maintainer: Your Name <youremail@domain.com>
@@ -11,22 +9,22 @@ pkgrel=0
 pkgdesc=""
 url=""
 arch="all"
-license="GPL"
+license="unknown"
 depends=
 depends_dev=
 makedepends="$depends_dev"
 install=
 subpackages="$pkgname-dev $pkgname-doc"
-source="https://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
+source="https://downloads.sourceforge.net/NAME/NAME-$pkgver.tar.gz"
 
 builddir="$srcdir"/$pkgname-$pkgver
 
 prepare() {
-	cd "$builddir"
+	default_prepare
+	# When needed add additional preparation below. Otherwise remove this function
 }
 
 build() {
-	cd "$builddir"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man \
@@ -35,7 +33,6 @@ build() {
 }
 
 package() {
-	cd "$builddir"
 	make DESTDIR="$pkgdir" install
 
 	# remove the 2 lines below (and this) if there is no init.d script
@@ -44,10 +41,9 @@ package() {
 }
 
 check() {
-	# uncomment the 2 lines below if there is a testsuite.  we assume the testsuite
+	# uncomment the line below if there is a testsuite.  we assume the testsuite
 	# is run using "make check", which is the default for autotools-based build systems.
-	# cd "$builddir"
 	# make check
 }
 
-md5sums="" #generate with 'abuild checksum'
+sha512sums="" #generate with 'abuild checksum'

sample.confd

@@ -1,7 +1,10 @@
-# Sample conf.d file for alpine linux
+# Configuration for /etc/init.d/<SERVICE>
 
-#
-# Specify daemon options here.
-#
+# User (and group) to run <SERVICE> as.
+#command_user="<USER>[:<GROUP>]"
 
-sample_opts=""
+# Additional arguments for <SERVICE> daemon.
+#command_args=
+
+# Comment out to disable process supervisor.
+supervisor=supervise-daemon

sample.initd

@@ -1,14 +1,14 @@
 #!/sbin/openrc-run
 
-# Sample init.d file for alpine linux.
+name="SampleService"
+description="Sample init.d file for Alpine Linux"
 
-name=
-command="/usr/sbin/$name"
-command_args="$sample_opts"
+: "${command_user:="<USER>"}"
+
+command="/usr/sbin/<SERVICE>"
+: "${command_args:="--default-args"}"
 command_background="yes"
-
-start_stop_daemon_args="--user $sample_user:$sample_group"
-pidfile="/run/$name.pid"
+pidfile="/run/$RC_SVCNAME.pid"
 
 depend() {
 	need net

tests/abuild_fetch_test

@@ -141,7 +141,7 @@ abuild_fetch_locking_body() {
 		pid1=\$!
 
 		# give enough time for abuild-fetch to call curl
-		sleep 0.2
+		sleep 0.5
 
 		# the first stamp should not exist, second instance should block the retry
 		if [ -e stamp3 ]; then

tests/abuild_keygen_test

@@ -15,6 +15,7 @@ init_tests \
 	abuild_keygen_kernel \
 
 export ABUILD_SHAREDIR="$SRCDIR"/..
+export ABUILD_USERDIR="$HOME"/.abuild
 export GIT=false
 export FAKEKEY="$SRCDIR/testdata/abuild.key"
 export FAKEKEYPUB="$SRCDIR/testdata/abuild.key.pub"

tests/abuild_sign_test

@@ -9,9 +9,13 @@ init_tests \
 	abuild_sign_installed_missing_pub \
 	abuild_sign_installed_missing_priv \
 	abuild_sign_installed \
-	abuild_sign_owner
+	abuild_sign_owner_type_invalid \
+	abuild_sign_owner_type_default \
+	abuild_sign_owner_type_rsa \
+	abuild_sign_owner_type_rsa256
 
 export ABUILD_SHAREDIR="$(atf_get_srcdir)/.."
+export ABUILD_USERDIR="$HOME"/.abuild
 
 init_keys() {
 	cp -ra "$(atf_get_srcdir)"/testdata/.abuild "$PWD"
@@ -63,7 +67,14 @@ abuild_sign_installed_body() {
 		abuild-sign --installed
 }
 
-abuild_sign_owner_body() {
+abuild_sign_owner_type_invalid_body() {
+	init_keys
+	atf_check -s exit:1 \
+		-e match:"abuild-sign: supported types are RSA and RSA256" \
+		abuild-sign -t DSA foo.tar.gz
+}
+
+abuild_sign_owner_type_default_body() {
 	init_keys
 	echo foo > .PKGINFO
 	tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
@@ -73,6 +84,34 @@ abuild_sign_owner_body() {
 		abuild-sign foo.tar.gz
 
 	atf_check -s exit:0 \
-		-o match:"0/0.*\.SIGN\.RSA" \
+		-o match:"0/0.*\.SIGN\.RSA\." \
+		tar -ztvf foo.tar.gz
+}
+
+abuild_sign_owner_type_rsa_body() {
+	init_keys
+	echo foo > .PKGINFO
+	tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
+
+	atf_check -s exit:0 \
+		-e match:"Signed" \
+		abuild-sign -t RSA foo.tar.gz
+
+	atf_check -s exit:0 \
+		-o match:"0/0.*\.SIGN\.RSA\." \
+		tar -ztvf foo.tar.gz
+}
+
+abuild_sign_owner_type_rsa256_body() {
+	init_keys
+	echo foo > .PKGINFO
+	tar -zcf foo.tar.gz .PKGINFO || atf_fail "Failed to create unsigned test archive"
+
+	atf_check -s exit:0 \
+		-e match:"Signed" \
+		abuild-sign -t RSA256 foo.tar.gz
+
+	atf_check -s exit:0 \
+		-o match:"0/0.*\.SIGN\.RSA256\." \
 		tar -ztvf foo.tar.gz
 }

tests/abuild_test

@@ -10,11 +10,11 @@ init_tests \
 	abuild_invalid_filename \
 	abuild_usr_lib64 \
 	abuild_dbg_subpackage \
-	abuild_SETFATTR_in_dbg \
 	abuild_reproducible \
 	abuild_checksum_generation \
 	abuild_checksum_duplicates \
 	abuild_subpkg_dep_leak \
+	abuild_subpkg_libs \
 	abuild_py_providers_creation \
 	abuild_py_dependency_scan \
 	abuild_py_dependency_scan_conflict \
@@ -23,11 +23,17 @@ init_tests \
 	abuild_invalid_pkgnames \
 	abuild_invalid_subpkgnames \
 	abuild_invalid_subpkg_version \
-	abuild_warn_pkgver_patch_version \
+	abuild_provide_pkgname \
+	abuild_validate_depends \
+	abuild_subpackage_arch \
+	abuild_large_doc_subpackage \
+	abuild_bigdocs \
+	abuild_pkgver_digit_letter_digit \
 	abuild_multiline_license \
+	abuild_license_spdx \
 	abuild_git_ceiling \
-	abuild_package_size_zero \
-	abuild_package_size_nonzero \
+	abuild_package_size \
+	abuild_keepdirs \
 	abuild_amove \
 	abuild_doc \
 	abuild_dev \
@@ -37,7 +43,15 @@ init_tests \
 	abuild_cleanoldpkg \
 	abuild_path_with_spaces \
 	abuild_pyc_warn \
-	abuild_pyc
+	abuild_pyc \
+	abuild_setcap_binary \
+	abuild_setcap_binary_with_option \
+	abuild_command_provides \
+	abuild_gocache_dir \
+	abuild_cargo_home_dir \
+	abuild_fish_comp_split \
+	abuild_deps \
+	abuild_usr_merge
 
 export ABUILD_SHAREDIR=$(atf_get_srcdir)/..
 export ABUILD_CONF=/dev/null
@@ -74,7 +88,7 @@ abuild_simple_pkg_without_deps_body() {
 	init_keys
 	cp -r "$testrepo"/pkg1 .
 	cd pkg1
-	atf_check -s exit:0 \
+	atf_check -s exit:0 -o ignore \
 		-e not-match:"WARNING" \
 		-e not-match:"fatal" \
 		abuild
@@ -226,16 +240,6 @@ abuild_dbg_subpackage_body() {
 	fi
 }
 
-abuild_SETFATTR_in_dbg_body() {
-	init_keys
-	cp -ra "$testrepo"/dbgpkg .
-	cd dbgpkg
-	SETFATTR=true atf_check -s exit:0 \
-		-o match:"hello world" \
-		-e match:"Build complete" \
-		abuild
-}
-
 abuild_reproducible_body() {
 	init_keys
 	cp -ra "$testrepo" .
@@ -248,12 +252,12 @@ abuild_reproducible_body() {
 	pkgs=$(abuild listpkg)
 
 	abuild || atf_fail "first build failed"
-	checksums=$(cd "$REPODEST"/testrepo/$arch && md5sum $pkgs)
+	checksums=$(cd "$REPODEST"/testrepo/$arch && sha512sum $pkgs)
 	echo "$checksums"
 
 	rm -r "$REPODEST"/testrepo
 	abuild || atf_fail "rebuild failed"
-	checksums2=$(cd "$REPODEST"/testrepo/$arch && md5sum $pkgs)
+	checksums2=$(cd "$REPODEST"/testrepo/$arch && sha512sum $pkgs)
 	echo "$checksums2"
 
 	if [ "$checksums" != "$checksums2" ]; then
@@ -332,6 +336,35 @@ abuild_subpkg_dep_leak_body() {
 		|| atf_fail "subpkg-dep-leak-subpkg should not depend on tar"
 }
 
+abuild_subpkg_libs_body() {
+	init_keys
+	mkdir -p testrepo/pkg
+	cd testrepo/pkg
+	cat > APKBUILD <<-EOF
+		maintainer="Natanael Copa <ncopa@alpinelinux.org>"
+		pkgname="pkg"
+		pkgver=1.0
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		subpackages="\$pkgname-libs"
+		options="!check"
+
+		package() {
+			mkdir -p "\$pkgdir"/usr/lib
+			touch "\$pkgdir"/usr/lib/libfoo.so.1
+		}
+	EOF
+	abuild clean unpack prepare build rootpkg || atf_fail "abuild failed"
+	if ! [ -e pkg/pkg-libs/usr/lib/libfoo.so.1 ]; then
+		find pkg
+		atf_fail "libfoo.so.1 was not moved"
+	fi
+}
+
+
 abuild_py_providers_creation_body() {
 	init_keys
 	cp -ra "$testrepo" .
@@ -395,14 +428,17 @@ abuild_valid_pkgnames_body() {
 	cp -ra "$testrepo"/test-pkgname .
 	cd test-pkgname
 	atf_check -s exit:0 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 	TESTNAME=foo atf_check -s exit:0 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 	TESTSUBNAME=foo atf_check -s exit:0 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
+	TESTNAME="more_+-2.0-complicated" atf_check -s exit:0 \
+		-e match:"Validating" \
+		abuild validate
 }
 
 abuild_invalid_pkgnames_body() {
@@ -410,14 +446,20 @@ abuild_invalid_pkgnames_body() {
 	cp -ra "$testrepo"/test-pkgname .
 	cd test-pkgname
 	TESTNAME="" atf_check -s exit:1 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 	TESTNAME="-foo" atf_check -s exit:1 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 	TESTNAME="foo with spaces" atf_check -s exit:1 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
+	TESTNAME="width@at" atf_check -s exit:1 \
+		-e match:"Validating" \
+		abuild validate
+	TESTNAME="width=equal" atf_check -s exit:1 \
+		-e match:"Validating" \
+		abuild validate
 }
 
 abuild_invalid_subpkgnames_body() {
@@ -425,11 +467,11 @@ abuild_invalid_subpkgnames_body() {
 	cp -ra "$testrepo"/test-pkgname .
 	cd test-pkgname
 	TESTSUBNAME="" atf_check -s exit:1 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 	TESTSUBNAME="-foo" atf_check -s exit:1 \
-		-e match:"Checking sanity" \
-		abuild sanitycheck
+		-e match:"Validating" \
+		abuild validate
 }
 
 abuild_invalid_subpkg_version_body() {
@@ -441,25 +483,108 @@ abuild_invalid_subpkg_version_body() {
 		abuild all
 }
 
-abuild_warn_pkgver_patch_version_body() {
+abuild_provide_pkgname_body() {
+	init_keys
 	cp -ra "$testrepo"/test-pkgname .
 	cd test-pkgname
-	TESTPKGVER=1.0_p1 atf_check -s exit:0 \
-		-e not-match:'WARNING' \
-		abuild sanitycheck
-	TESTPKGVER=1.0p1 atf_check -s exit:0 \
-		-e match:'WARNING.*1.0_p1' \
-		abuild sanitycheck
+	TESTNAME=provided atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild validate
+	TESTNAME=test TESTPROVIDES='test~1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild validate
+	TESTNAME=test TESTPROVIDES='test=1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild validate
+	TESTNAME=test TESTPROVIDES='test>1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild validate
+	TESTNAME=test TESTPROVIDES='test<=1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild validate
+}
+
+abuild_validate_depends_body() {
+	init_keys
+	cp -ra "$testrepo"/test-pkgname .
+	cd test-pkgname
+	TESTDEPENDS="foo" TESTMAKEDEPENDS="bar" \
+		atf_check -s exit:0 \
+		-e match:"Validating" \
+		abuild validate
+	TESTDEPENDS="foo=1.0 bar>=1.0" TESTMAKEDEPENDS="baz<=1.0 x<2.0 z>1 !blah" \
+		atf_check -s exit:0 \
+		-e match:"Validating" \
+		abuild validate
+	TESTDEPENDS="foo~1.0 bar>~1.0 baz<~1"
+		atf_check -s exit:0 \
+		-e match:"Validating" \
+		abuild validate
+
+	for i in "foo=bar" "foo=~1.0" "foo>1.0_invalid"; do \
+		TESTDEPENDS="$i" atf_check -s exit:1 \
+			-e match:"Validating" \
+			abuild validate
+	done
+}
+
+abuild_subpackage_arch_body() {
+	init_keys
+	cp -ra "$testrepo" .
+	cd testrepo/subpackage-arch
+	arch="$(abuild -A)"
+
+	for i in noarch all "$arch"; do
+		TESTSUBARCH="$i" abuild all
+
+		[ -f "$REPODEST/testrepo/$arch/test-pkgname-$i-1.0-r0.apk" ] || \
+			atf_fail "Failed to place $i arch subpackage correctly"
+		rm -rf "$REPODEST/testrepo"
+	done
+}
+
+abuild_large_doc_subpackage_body() {
+	init_keys
+	cp -ra "$testrepo"/large-doc-subpkg .
+	cd large-doc-subpkg
+	atf_check -s exit:0 -o ignore \
+		-e match:"-doc subpackage is unusually large" \
+		abuild all
+}
+
+abuild_bigdocs_body() {
+	init_keys
+	cp -ra "$testrepo"/large-doc-subpkg .
+	cd large-doc-subpkg
+	options=bigdocs atf_check -s exit:0 -o ignore \
+		-e not-match:"-doc subpackage is unusually large" \
+		abuild all
+}
+
+abuild_pkgver_digit_letter_digit_body() {
+	cp -ra "$testrepo"/test-pkgname .
+	cd test-pkgname
+	TESTPKGVER=1.0p1 atf_check -s exit:1 \
+		-e match:'ERROR.*version' \
+		abuild validate
 }
 
 abuild_multiline_license_body() {
 	cp -ra "$testrepo"/test-licenses .
 	cd test-licenses
 	abuild rootpkg
-	atf_check -o match:'^license = MIT AND GPL-3.0-only OR GPL-3.0-or-later AND BSD-Clause-4$' \
+	atf_check -o match:'^license = MIT AND \(GPL-3.0-only OR GPL-3.0-or-later AND BSD-4-Clause\)$' \
 		cat pkg/.control.test-licenses/.PKGINFO
 }
 
+abuild_license_spdx_body() {
+	cp -ra "$testrepo"/test-licenses .
+	cd test-licenses
+	TESTPKGVER=1.0_p1 atf_check -s exit:0 \
+		-e not-match:'WARNING' \
+		abuild validate
+}
+
 abuild_git_ceiling_body() {
 	init_keys
 	git init
@@ -490,76 +615,136 @@ abuild_git_ceiling_body() {
 		abuild
 }
 
-
-create_fake_du() {
-	mkdir -p bin
-	cat > bin/du <<-EOF
-		#!/bin/sh
-		echo 0
-	EOF
-	chmod +x bin/du
-	PATH="$PWD/bin:$PATH"
-}
-
-abuild_package_size_zero_body() {
+abuild_package_size_body() {
 	init_keys
 	mkdir -p test-size
-	create_fake_du
 
 	cd test-size
 	cat > APKBUILD <<-EOF
 		# Maintainer: Test User 123 <123@example.com>
-
-		# test package
-	 	pkgname="test-size"
+		pkgname="test-size"
 		pkgver="1.0"
 		pkgrel=0
 		pkgdesc='Dummy test package that has no files'
 		url='https://gitlab.alpinelinux.org/alpine/aports'
 		arch='noarch'
 		license='MIT'
-		install="\$pkgname.post-install"
+		install="\$pkgname-empty-script.post-install"
+		trigger="\$pkgname-empty-trigger.trigger=/"
+		subpackages="
+			\$pkgname-empty-noscript:_empty
+			\$pkgname-empty-script:_empty
+			\$pkgname-empty-trigger:_empty
+			\$pkgname-dirs:_dirs
+			\$pkgname-files:_files
+			\$pkgname-many:_many
+			\$pkgname-holes:_holes
+			\$pkgname-hardlink:_hardlink
+			\$pkgname-symlink:_symlink
+		"
+
+		# Test if multi line bc output is handle properly
+		export BC_LINE_LENGTH=1
 
 		package() {
 			mkdir -p "\$pkgdir"
 		}
+
+		_empty() {
+			mkdir -p "\$subpkgdir"
+		}
+
+		_dirs() {
+			mkdir -p "\$subpkgdir/a/ /v/e/r/y/ /d/e/e/p/ /d/i/r"
+			mkdir -p "\$subpkgdir"/b "\$subpkgdir"/c
+		}
+
+		_files() {
+			mkdir -p "\$subpkgdir"
+			cd "\$subpkgdir"
+			printf 'test\\n' > test
+			touch empty
+			mkdir -p dir
+			printf 'more\\n' > dir/more
+			printf 'size leak!\\n' > secret
+			chmod a-rwx secret
+			printf 'quoting and stuff\\n' > dir/"\\\$can't \\"touch \\\\this"
+		}
+
+		_many() {
+			mkdir -p "\$subpkgdir"
+			for i in \$(seq 10000); do
+				printf '\\n' > "\$subpkgdir/\$i"
+			done
+		}
+
+		_holes() {
+			mkdir -p "\$subpkgdir"
+			dd if=/dev/zero bs=1 seek=65534 count=1 of="\$subpkgdir"/holes
+		}
+
+		_hardlink() {
+			mkdir -p "\$subpkgdir"
+			cd "\$subpkgdir"
+			printf 'test\\n' > test
+			ln test link
+			ln test link2
+		}
+
+		_symlink() {
+			mkdir -p "\$subpkgdir"
+			ln -s / "\$subpkgdir"/link
+		}
 	EOF
-	cat > test-size.post-install <<-EOF
+	cat > test-size-empty-script.post-install <<-EOF
+		#!/bin/sh
+		echo 1
+	EOF
+	cat > test-size-empty-trigger.trigger <<-EOF
 		#!/bin/sh
 		echo 1
 	EOF
 	abuild rootpkg
-	# should be set to 1
-	atf_check -o match:'^size = 1$' \
-		cat pkg/.control.test-size/.PKGINFO
+	local i size
+	for i in \
+		empty-noscript:0 \
+		empty-script:1 \
+		empty-trigger:1 \
+		dirs:1 \
+		files:39 \
+		many:10000 \
+		holes:65535 \
+		hardlink:5 \
+		symlink:1 \
+		; do \
+		size=$(awk -F ' = ' '$1 == "size" {print $2}' pkg/.control.test-size-${i%:*}/.PKGINFO)
+		[ "$size" -eq "${i#*:}" ] ||
+			atf_fail "$i failed: got $size"
+	done
 }
 
-abuild_package_size_nonzero_body() {
+abuild_keepdirs_body() {
 	init_keys
-	mkdir -p test-size
+	mkdir -p test-amove
 
-	cd test-size
+	cd test-amove
 	cat > APKBUILD <<-EOF
 		# Maintainer: Test User 123 <123@example.com>
-
-		# test package
-	 	pkgname="test-size"
+		pkgname="test-keepdirs"
 		pkgver="1.0"
 		pkgrel=0
-		pkgdesc='Dummy test package that has files'
+		pkgdesc='Dummy test package - keepdirs'
 		url='https://gitlab.alpinelinux.org/alpine/aports'
 		arch='noarch'
 		license='MIT'
+		options='keepdirs'
 
 		package() {
-			mkdir -p "\$pkgdir"
-			printf "%s" "very important data" > "\$pkgdir"/testfile
+			mkdir -p "\$pkgdir"/usr/bin
 		}
 	EOF
-	abuild rootpkg
-	# should not be set to 1
-	atf_check -o not-match:'^size = 1$' \
-		cat pkg/.control.test-size/.PKGINFO
+	abuild rootpkg || atf_fail "abuild rootpkg failed"
+	test -d pkg/test-keepdirs/usr/bin || atf_fail "$i failed"
 }
 
 abuild_amove_body() {
@@ -569,8 +754,6 @@ abuild_amove_body() {
 	cd test-amove
 	cat > APKBUILD <<-EOF
 		# Maintainer: Test User 123 <123@example.com>
-
-		# test package
 		pkgname="test-amove"
 		pkgver="1.0"
 		pkgrel=0
@@ -582,37 +765,49 @@ abuild_amove_body() {
 			\$pkgname-etc:_etc
 			\$pkgname-bin:_bin
 			\$pkgname-sbin:_sbin
+			\$pkgname-root:_root
 			\$pkgname-var:_var
-			\$pkgname-usr:_usr"
+			\$pkgname-usr:_usr
+			\$pkgname-space:_space"
 
 		package() {
 			mkdir -p "\$pkgdir"/etc \
-				"\$pkgdir"/bin \
-				"\$pkgdir"/sbin \
+				"\$pkgdir"/usr/bin \
+				"\$pkgdir"/usr/sbin \
 				"\$pkgdir"/var/lib/\$pkgname \
 				"\$pkgdir"/usr/share
 			touch "\$pkgdir"/etc/file \
 				"\$pkgdir"/etc/\$pkgname.conf \
-				"\$pkgdir"/bin/hello \
-				"\$pkgdir"/sbin/shello \
+				"\$pkgdir"/usr/bin/hello \
+				"\$pkgdir"/usr/sbin/shello \
+				"\$pkgdir"/root \
+				"\$pkgdir"/usr/sbin/space' ' \
 				"\$pkgdir"/var/lib/\$pkgname/testfile \
 				"\$pkgdir"/usr/share/a \
 				"\$pkgdir"/usr/share/b
+			ln -s dangling "\$pkgdir"/symlink
 		}
 		_file() {
 			amove etc/file
 		}
 		_etc() {
 			# leading and trailing /
-			amove /etc/
+			amove ///etc/
 		}
 		_bin() {
 			# trailing /
-			amove bin/
+			amove usr/bin///
 		}
 		_sbin() {
+			# no leading and trailing /
+			amove usr/sbin/shello
+		}
+		_root() {
 			# no /
-			amove sbin/shello
+			amove root
+
+			# symlink without existing target
+			amove symlink
 		}
 		_var() {
 			# leading /
@@ -621,6 +816,11 @@ abuild_amove_body() {
 		_usr() {
 			# glob *
 			amove usr/share/*
+			! amove no-glob-match/*
+		}
+		_space() {
+			# with space
+			amove usr/sbin/space' '
 		}
 
 	EOF
@@ -628,13 +828,16 @@ abuild_amove_body() {
 	for i in \
 			test-amove-file/etc/file \
 			test-amove-etc/etc/test-amove.conf \
-			test-amove-bin/bin/hello \
-			test-amove-sbin/sbin/shello \
+			test-amove-bin/usr/bin/hello \
+			test-amove-sbin/usr/sbin/shello \
+			test-amove-root/root \
+			test-amove-root/symlink \
 			test-amove-var/var/lib/test-amove/testfile \
 			test-amove-usr/usr/share/a \
 			test-amove-usr/usr/share/b \
+			test-amove-space/usr/sbin/space' ' \
 			; do \
-		test -f pkg/$i || atf_fail "$i failed"
+		[ -L pkg/"$i" ] || [ -e pkg/"$i" ] || atf_fail "$i failed"
 	done
 }
 
@@ -645,7 +848,6 @@ abuild_doc_body() {
 	cd foo
 	cat > APKBUILD <<-EOF
 		# Maintainer: Test User 123 <123@example.com>
-		# test package
 		pkgname="foo"
 		pkgver="1.0"
 		pkgrel=0
@@ -683,7 +885,6 @@ abuild_dev_body() {
 	cd foo
 	cat > APKBUILD <<-EOF
 		# Maintainer: Test User 123 <123@example.com>
-		# test package
 		pkgname="foo"
 		pkgver="1.0"
 		pkgrel=0
@@ -792,7 +993,6 @@ abuild_cleanoldpkg_body() {
 		for v in 0.9 1.0 1.1; do
 			cat > APKBUILD <<-EOF
 				# Maintainer: Test User 123 <123@example.com>
-				# test package
 				pkgname="foo"
 				pkgver="$v"
 				pkgrel=0
@@ -805,7 +1005,7 @@ abuild_cleanoldpkg_body() {
 					mkdir -p "\$pkgdir"
 				}
 			EOF
-			CARCH=$arch atf_check -e not-empty abuild
+			CARCH=$arch atf_check -e not-empty abuild clean unpack rootpkg
 		done
 	done
 
@@ -902,3 +1102,266 @@ abuild_pyc_body() {
 	atf_check -o match:"foo=1.0-r0" -o match:"pyc" \
 		grep install_if pkg/.control.foo-pyc/.PKGINFO
 }
+
+abuild_setcap_binary_body() {
+	init_keys
+	cp -ra "$testrepo"/setcap .
+	cd setcap
+	atf_check -s exit:1 \
+		-e match:"Found binary with extra capabilities" \
+		-e match:"Found setcap binary executable by others" \
+		abuild all
+}
+
+abuild_setcap_binary_with_option_body() {
+	init_keys
+	cp -ra "$testrepo"/setcap .
+	cd setcap
+	options=setcap atf_check -s exit:0 \
+		-e not-match:"Found binary with extra capabilities" \
+		-e match:"Found setcap binary executable by others" \
+		abuild all
+}
+
+abuild_command_provides_body() {
+	init_keys
+	mkdir testprovides
+	cd testprovides
+	cat >APKBUILD<<-EOF
+		# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+		pkgname=testprovides
+		pkgver=1.0
+		pkgrel=0
+		pkgdesc="Dummy test package that installs a file and directory in path"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() { mkdir -p "\$builddir"; }
+		build() { true; }
+		check() { true; }
+		package() {
+			mkdir -p "\$pkgdir/usr/bin"
+			printf "%s\n" '#!/bin/sh' >"\$pkgdir/usr/bin/foo"
+			chmod +x "\$pkgdir/usr/bin/foo"
+			cp -a "\$pkgdir/usr/bin/foo" "\$pkgdir/usr/bin/foo@"
+			mkdir -p "\$pkgdir/usr/bin/dir/"
+			ln -s /usr/bin/not-on-the-host-system-but-in-a-dependency "\$pkgdir/usr/bin/link"
+		}
+	EOF
+	abuild rootpkg
+
+	atf_check \
+		-o match:"provides = cmd:foo=1.0-r0" \
+		-o not-match:"provides = cmd:foo@=1.0-r0" \
+		-o match:"provides = cmd:link=1.0-r0" \
+		-o not-match:"provides = cmd:dir=1.0-r0" \
+		grep '^provides = ' pkg/.control.testprovides/.PKGINFO
+}
+
+abuild_gocache_dir_body() {
+	init_keys
+	mkdir gocache-dir
+	cd gocache-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="gocache-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		build() {
+			echo "dir:\$GOCACHE"
+		}
+		package() {
+			:
+		}
+	EOF
+
+	unset GOCACHE
+	MOVE_CACHES=1 \
+	atf_check -s exit:0 \
+		-o match:"dir:.*/tmp/go" \
+		abuild prepare build
+}
+
+abuild_cargo_home_dir_body() {
+	init_keys
+	mkdir cargo-home-dir
+	cd cargo-home-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="cargo-home-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		build() {
+			echo "dir:\$CARGO_HOME"
+		}
+		package() {
+			:
+		}
+	EOF
+
+	unset CARGO_HOME
+	MOVE_CACHES=1 \
+	atf_check -s exit:0 \
+		-o match:"dir:.*/tmp/cargo" \
+		abuild prepare build
+}
+
+abuild_fish_comp_split_body() {
+	init_keys
+	mkdir fish-split-dir
+	cd fish-split-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="fish-split-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		package() {
+			mkdir -p "\$pkgdir"/usr/share/fish/completions/
+			mkdir -p "\$pkgdir"/usr/share/fish/vendor_completions.d/
+			echo "comp" > "\$pkgdir"/usr/share/fish/completions/comp.fish
+			echo "comp" > "\$pkgdir"/usr/share/fish/vendor_completions.d/comp.fish
+		}
+	EOF
+	# test that there is a warning for the legacy dir existing
+	atf_check -s exit:0 \
+		-e match:"fish completions for programs should be located in /usr/share/fish/vendor_completions.d" \
+		abuild prepare build rootpkg
+
+	# now add the correct subpackage
+	echo 'subpackages="$pkgname-fish-completion"' >> APKBUILD
+	abuild clean prepare build rootpkg
+
+	if ! [ -d pkg/fish-split-dir-fish-completion/usr/share/fish/completions ]; then
+		echo "missing old dir"
+		exit 1
+	fi
+	if ! [ -d pkg/fish-split-dir-fish-completion/usr/share/fish/vendor_completions.d ]; then
+		echo "missing new dir"
+		exit 1
+	fi
+}
+
+create_mock_apk() {
+	mkdir -p usr/bin
+	cat > usr/bin/apk <<-EOF
+		#!/bin/sh
+		if [ "\$1" = "--print-arch" ]; then
+			echo 'aarch64'
+			exit 0
+		fi
+		printf 'apk %s\n' "\$*" >&2
+	EOF
+	chmod +x usr/bin/apk
+	ln -s apk usr/bin/abuild-apk
+	PATH="$PWD/usr/bin:$PATH"
+}
+
+abuild_deps_body() {
+	create_mock_apk
+	mkdir testdeps
+	cd testdeps
+	cat >APKBUILD <<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="testdeps"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		depends="foo"
+		makedepends="bar"
+		checkdepends="checkdep"
+		makedepends_host="hostdep"
+		makedepends_build="builddep"
+	EOF
+
+	# native build. pull in both depends and makedepends
+	# do not install in any --root
+	atf_check \
+		-e match:'Installing for build: foo bar checkdep$' \
+		-e match:'apk add .*--virtual .makedepends-testdeps foo bar checkdep' \
+		-e not-match:'apk add .*--root' \
+		abuild deps
+
+	# dont install checkdep with ABUILD_BOOTSTRAP
+	ABUILD_BOOTSTRAP=1 atf_check \
+		-e not-match:"apk add.*checkdep" \
+		abuild deps
+
+	# crosscompile:
+	#   install makedepends_build without --root
+	#   install makedepends_host with --root
+	CTARGET='s390x' CHOST='ppc64le' CBUILDROOT="$PWD/root" atf_check \
+		-e match:'Installing for build: builddep' \
+		-e match:'Installing for host: hostdep' \
+		-e match:'apk add .*--virtual .makedepends-testdeps builddep' \
+		-e not-match:'apk add.*--root.*builddep' \
+		-e match:'apk add .*--root.*hostdep' \
+		-e match:'apk add .*--arch s390x.*hostdep' \
+		-e not-match:'apk add.*checkdep' \
+		abuild deps
+
+	# crosscompile, set only CHOST
+	CHOST='armhf' atf_check \
+		-e match:'apk add.*builddep' \
+		-e not-match:'apk add.*--root.*builddep' \
+		-e match:'apk add.*--root.*--arch armhf.*hostdep' \
+		-e not-match:'apk add.*--arch armhf.*builddep' \
+		abuild deps
+
+	# Check shell_escape
+	atf_check \
+		-e match:"apk add .*--repository It's \\\\b'\"\"'  \"escaped\"/.*" \
+		abuild -P "It's \b'\"\"'  \"escaped\"" deps
+}
+
+abuild_usr_merge_body() {
+	init_keys
+	mkdir usrmergetest
+	cd usrmergetest
+	cat >APKBUILD <<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="usrmergetest"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		options="!check"
+
+		package() {
+			mkdir -p \
+				"\$pkgdir"/lib \
+				"\$pkgdir"/bin \
+				"\$pkgdir"/sbin
+		}
+	EOF
+	atf_check -s exit:0 \
+		-e match:"WARNING:.*: Packages must not put anything under /lib, use /usr/lib instead" \
+		-e match:"WARNING:.*: Packages must not put anything under /bin, use /usr/bin instead" \
+		-e match:"WARNING:.*: Packages must not put anything under /sbin, use /usr/bin instead" \
+		abuild
+}

tests/checkapk_test

@@ -0,0 +1,40 @@
+#!/usr/bin/env atf-sh
+
+. $(atf_get_srcdir)/test_env.sh
+init_tests \
+	checkapk_help \
+	checkapk_invalid_opt \
+	checkapk_missing_abuild_conf \
+	checkapk_missing_apkbuild
+
+DATADIR=$(atf_get_srcdir)/testdata
+
+export ABUILD_SHAREDIR=$(atf_get_srcdir)/..
+export ABUILD_CONF=/dev/null
+export ABUILD_USERCONF=/dev/null
+
+checkapk_help_body() {
+	atf_check -s exit:0 \
+		-o match:"Usage:" \
+		checkapk --help
+}
+
+checkapk_invalid_opt_body() {
+	atf_check -s not-exit:0 \
+		-e match:"Usage:" \
+		checkapk --invalid
+}
+
+checkapk_missing_abuild_conf_body() {
+	ABUILD_DEFCONF=/dev/null atf_check \
+		-s not-exit:0 \
+		-e match:"no abuild.conf found" \
+		checkapk
+}
+
+checkapk_missing_apkbuild_body() {
+	atf_check \
+		-s not-exit:0 \
+		-e match:"must be run in the directory of a built package" \
+		checkapk
+}

tests/testrepo/dbgpkg/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname="dbgpkg"
 pkgver="1.0"
 pkgrel=0

tests/testrepo/invalid-filename/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname="invalid-filename"
 pkgver="1.0"
 pkgrel=0

tests/testrepo/large-doc-subpkg/APKBUILD

@@ -0,0 +1,33 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname="large-doc-subpkg"
+pkgver="1.0"
+pkgrel=0
+pkgdesc="Dummy test package to check if large doc subpackages cause a warning to be emitted"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+subpackages="$pkgname-doc"
+source=""
+
+prepare() {
+	mkdir -p "$builddir"
+}
+
+build() {
+	true
+}
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir/usr/bin"
+	cat >"$pkgdir/usr/bin/foo" <<EOF
+	#!/bin/sh
+EOF
+
+	mkdir -p "$pkgdir/usr/share/doc/$pkgname"
+	dd bs=1024 count=$((3 * 1024)) if=/dev/random \
+		of="$pkgdir/usr/share/doc/$pkgname/large-file"
+}

tests/testrepo/lib64test/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname="lib64test"
 pkgver="1.0"
 pkgrel=0

tests/testrepo/pkg path with spaces/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname="pkg-path-with-spaces"
 pkgver="1.0"
 pkgrel=0

tests/testrepo/pkg1/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname="pkg1"
 pkgver="1.0"
 pkgrel=0

tests/testrepo/setcap/APKBUILD

@@ -0,0 +1,31 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=setcap
+pkgver="1.0"
+pkgrel=0
+pkgdesc="Dummy test package that has an setcap binary but no setcap option"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+source=""
+
+prepare() {
+	mkdir -p "$builddir"
+}
+
+build() {
+	true
+}
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir/usr/bin"
+	cat >"$pkgdir/usr/bin/foo" <<EOF
+	#!/bin/sh
+EOF
+	chmod +x "$pkgdir/usr/bin/foo"
+	setcap cap_net_bind_service=+ep "$pkgdir/usr/bin/foo"
+}
+

tests/testrepo/subpackage-arch/APKBUILD

@@ -0,0 +1,22 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=${TESTNAME-test-pkgname}
+pkgver="${TESTPKGVER-1.0}"
+pkgrel=0
+pkgdesc="Dummy subpackage arch"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+subpackages="$pkgname-$TESTSUBARCH:_sub:$TESTSUBARCH"
+options="!archcheck"
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir"
+}
+
+_sub() {
+	mkdir -p "$subpkgdir"
+}

tests/testrepo/test-licenses/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Olliver Schinagl <oliver@schinagl.nl>
-
-# test package
 pkgname="${TESTNAME-test-licenses}"
 pkgver="1.0"
 pkgrel=0
@@ -8,10 +6,10 @@ pkgdesc='Dummy test package that has multi-line licenses'
 url='https://gitlab.alpinelinux.org/alpine/aports'
 arch='noarch'
 license='MIT AND
-         GPL-3.0-only OR  
-  
- GPL-3.0-or-later AND   
-		 BSD-Clause-4
+         (GPL-3.0-only OR
+
+ GPL-3.0-or-later AND
+		 BSD-4-Clause)
 '
 
 prepare() {

tests/testrepo/test-pkgname/APKBUILD

@@ -1,6 +1,4 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-
-# test package
 pkgname=${TESTNAME-test-pkgname}
 pkgver="${TESTPKGVER-1.0}"
 pkgrel=0
@@ -8,7 +6,10 @@ pkgdesc="Dummy test package that fails to build"
 url="https://gitlab.alpinelinux.org/alpine/aports"
 arch="noarch"
 license="MIT"
+provides="${TESTPROVIDES-provided}"
 subpackages="${TESTSUBNAME-$pkgname-sub}:_sub"
+depends="$TESTDEPENDS"
+makedepends="$TESTMAKEDEPENDS"
 
 prepare() {
 	mkdir -p "$builddir"